I assume R1 main and backup connections does not share ip's.
My approach in such case would be to make sure router at R2 would be the one to initiate the connection.
At R2 I would create a set of netwatch entries:
- Netwatch1: ip=[a lan ip at R1] OnDown=/system script run StabilityCheck
- Netwatch2: ip=[R1.main.public.ip] OnDown=/system script run StabilityCheck OnUp=/system script run StabilityCheck
- Netwatch3: ip=[R1.backup.public.ip] OnDown=/system script run StabilityCheck
I would create scripts like these:
StabilityCheck
send x pings to R1.main.public.ip
send x pings to R1.backup.public.ip
analyse the ping response and decide which connection is the prefered
run script VpnMainInitiate or VpnBackupInitiate depending on which is prefered
/system scheduler disable initStabilityCheck
VpnMainInitiate
If mainVpn is disabled {
disable backupvpn
enable mainvpn
disable Netwatch3
}
if vpn is up {
disable Netwatch2
enable Netwatch1
disable scheduler VpnCheck
}
else
{
enable Netwatch3
enable Netwatch2
disable Netwatch1
}
}
VpnBackupInitiate
If backupVpn is disabled {
disable mainvpn
enable backupvpn
disable Netwatch3
enable Netwatch2
}
if vpn is up {
disable Netwatch2
enable Netwatch1
enable scheduler VpnCheck
}
else
{
enable Netwatch3
enable Netwatch2
disable Netwatch1
}
}
Scheduler VpnCheck: /system script run StabilityCheck
Point is: If connection inside vpn or to any of the R1 public ip's drop, check with ping which ip at R1 is the most stable and connect using that ip. If connection fails, or backup connection becomes the active one, enable a scheduler that will repeat the check every so often. If the main connection becomes the active one, wait for netWatch to trigger any recheck.